Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-20896.

Upgrade to Pro
CVE-2026-20896 IBM QRadar · QRadar

Detect Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896) in IBM QRadar

The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, "X-WEBAUTH-USER" AS webauthUser, URL, UTF8(payload) AS rawPayload, DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS eventTime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Gitea%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND UTF8(payload) ILIKE '%X-WEBAUTH-USER%'
AND NOT INCIDR(sourceip,'10.0.0.0/8') AND NOT INCIDR(sourceip,'172.16.0.0/12') AND NOT INCIDR(sourceip,'192.168.0.0/16')
LAST 24 HOURS
critical severity medium confidence

Detects X-WEBAUTH-USER header presence in web traffic to Gitea from source IPs outside trusted internal proxy subnets.

Data Sources

Web/reverse proxy log sourceGitea container log source

Required Tables

events

False Positives & Tuning

  • Recently reassigned proxy IP not yet reflected in CIDR whitelist
  • Cross-region failover proxy using a different internal subnet
  • Security scanning tool replaying header from allowed range but flagged due to stale CIDR list

Other platforms for CVE-2026-20896

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Direct X-WEBAUTH-USER header injection against Gitea container

    Expected signal: HTTP request log entry on the Gitea/reverse-proxy access log showing X-WEBAUTH-USER header with source IP of the test host

  2. Test 2Verify REVERSE_PROXY_TRUSTED_PROXIES wildcard misconfiguration

    Expected signal: Command execution logged in container audit/history; no network telemetry generated

  3. Test 3Impersonate arbitrary user and attempt privileged API call

    Expected signal: Gitea audit log entry for an admin API call sourced from an impersonated session; access log entry with X-WEBAUTH-USER header from untrusted source IP

Last updated: 2026-07-25 Research depth: standard
References (6)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-20896 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1078Valid AccountsT1190Exploit Public-Facing Application

Same Tactic: Initial Access

Popular Detections